CyberGlossary

Malware

Rootkit

Also known as: Stealth kit, Root-level malware

Definition

Stealth malware that grants and hides privileged access to an operating system or device, evading detection by standard tools.

A rootkit is a collection of tools or kernel/firmware components designed to give an attacker persistent, high-privilege access while concealing files, processes, registry keys, and network connections from defenders. Rootkits operate at different levels: user-mode (hooking APIs), kernel-mode (modifying the kernel), bootkit (boot loader), or firmware (UEFI/BIOS). They are typically dropped after initial compromise to maintain long-term presence and frustrate forensic analysis. Detection requires memory forensics, integrity verification, secure boot, EDR with kernel visibility, and offline scans. Mitigations include UEFI Secure Boot, signed drivers, vTPM-based attestation and minimizing kernel-mode software.

Examples

  • TDL/TDSS, a long-lived kernel-mode rootkit family targeting Windows.
  • ZeroAccess, used to hide click-fraud and Bitcoin-mining payloads.

Related terms